NDSS 2025 – Compiled Models, Built-In Exploits

Research presented at NDSS 2025 demonstrates that Rowhammer-driven bit-flip attacks against compiled DNN executables can severely degrade model accuracy by flipping as few as ~1–2 bits, by exploiting publicly known model structures embedded in executable code rather than confidential weights. The attacks are pervasive, transferable, evade existing defenses (including for quantized models), and underscore the need to integrate security mechanisms into deep learning compilation toolchains.